Add dark mode, i18n, messenger/moderation/verify, admin CRUD parity

Web-tier features completing the AtomCMS→Next.js conversion (slice 2):

UI/UX:
- Dark mode: html.dark CSS-var overrides + ThemeSwitcher (localStorage,
  no-flash boot script) wired into the nav.
- i18n (next-intl, cookie-based / no URL routing): en + it catalogs,
  request.ts, provider in root layout, LanguageSwitcher; shell (nav,
  header, footer) fully translated. URLs + access-guard unchanged.
- globals.css: --muted/--border aliases used across admin pages.

User features:
- /messages: offline messages + friend-request accept (server action
  re-reads session, two directional rows, idempotent).
- Email verification: signed-token /verify route + sendVerification wired
  into register (best-effort, never blocks signup).
- Article reactions: toggle UI on news/[slug] + server action.
- Content moderation service (website_wordfilter + optional OpenAI
  moderations, fail-open) wired into article comments + guestbook.

Admin CRUD parity (Filament replacement):
- /admin/shop (+ new/[id]) packages CRUD + read-only orders.
- /admin/transactions read-only PayPal log.
- /admin/permissions, /admin/tags, /admin/ads (+ new/[id]),
  /admin/help-questions (+ new/[id]), /admin/radio/history,
  /admin/users/[id]/edit. All gated by requireStaff + logStaffActivity.

Verified: tsc 0, vitest 48/48, next build 0 (all routes incl. new
admin CRUD + /messages + /verify).

src/app/verify/page.tsx

@@ -0,0 +1,103 @@
+import Link from "next/link";
+import { isValidVerificationToken } from "@/actions/email-verify";
+import { prisma } from "@/lib/prisma";
+
+// Reads + writes the live users table — must never be statically rendered.
+export const dynamic = "force-dynamic";
+
+type Status = "verified" | "already" | "invalid" | "unavailable";
+
+export default async function VerifyPage({
+  searchParams,
+}: {
+  searchParams: Promise<{ token?: string; email?: string }>;
+}) {
+  // Next 16: searchParams is a Promise.
+  const { token = "", email = "" } = await searchParams;
+  const normalisedEmail = email.trim().toLowerCase();
+
+  let status: Status = "invalid";
+
+  if (normalisedEmail && token) {
+    const ok = await isValidVerificationToken(normalisedEmail, token);
+    if (ok) {
+      try {
+        // mail is VARCHAR(500) and not unique in the emulator schema, so match
+        // on the email and flip any matching unverified account(s).
+        const user = await prisma.user.findFirst({
+          where: { mail: normalisedEmail },
+          select: { id: true, mailVerified: true },
+        });
+        if (!user) {
+          status = "invalid";
+        } else if (user.mailVerified === "1") {
+          status = "already";
+        } else {
+          await prisma.user.update({
+            where: { id: user.id },
+            // users.mail_verified is a String flag ('0' / '1').
+            data: { mailVerified: "1" },
+          });
+          status = "verified";
+        }
+      } catch {
+        // DB unreachable — don't claim success.
+        status = "unavailable";
+      }
+    } else {
+      status = "invalid";
+    }
+  }
+
+  return (
+    <main>
+      <h1>Email verification</h1>
+      <div className="card" style={{ marginTop: "1rem" }}>
+        {status === "verified" ? (
+          <>
+            <h2 style={{ marginTop: 0 }}>You're all set</h2>
+            <p className="muted">
+              Your email address has been verified. You can now log in and play.
+            </p>
+            <p style={{ marginTop: "1rem" }}>
+              <Link href="/login" className="btn btn-primary">
+                Go to login
+              </Link>
+            </p>
+          </>
+        ) : status === "already" ? (
+          <>
+            <h2 style={{ marginTop: 0 }}>Already verified</h2>
+            <p className="muted">This email address has already been confirmed.</p>
+            <p style={{ marginTop: "1rem" }}>
+              <Link href="/login" className="btn btn-primary">
+                Go to login
+              </Link>
+            </p>
+          </>
+        ) : status === "unavailable" ? (
+          <>
+            <h2 style={{ marginTop: 0 }}>Try again shortly</h2>
+            <p className="muted">
+              We couldn't reach the server to verify your email. Please retry the link in a
+              moment.
+            </p>
+          </>
+        ) : (
+          <>
+            <h2 style={{ marginTop: 0 }}>Invalid or expired link</h2>
+            <p className="muted">
+              This verification link is not valid. Make sure you opened the full link from your
+              email, or request a new one.
+            </p>
+            <p style={{ marginTop: "1rem" }}>
+              <Link href="/login" className="btn btn-outline">
+                Back to login
+              </Link>
+            </p>
+          </>
+        )}
+      </div>
+    </main>
+  );
+}